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AMENDMENTS TO THE CLAIMS 

Upon entry of this amendment, the following listing of claims will replace all prior 
versions and listings of claims in the pending application. 

IN THE CLAIMS 

Please amend claims 1, 3, 9, 17, 25 and 32 as follows: 

1 . (Currently Amended) A computer- implemented method for adaptively filtering URL 
messages routed across a network by generating exception rules to rejection rules based on 
attributes of URLs within messages previously received and rejected, the method comprising: 

receiving, by a gateway, a first message specifying a first URL component; 

rejecting, by the gateway, the first message based on a rejection rule, the rejection 
rule rejecting messages based on the messages comprising the first URL component; 

maintaining, by the gateway, a frequency for the first URL component, wherein 
the frequency is a function of a number of occurrences with which messages containing 
the first URL component were rejected and a number of occurrences with which 
messages containing descendants of the first URL component were rejected; 

generating, by the gateway, an exception rule to the rejection rule for the first 
URL component and its descendants responsive to the frequency of the first URL 
component satisfying a set of constraints, the exception rule allowing to pass a message 
based on the message comprising the first URL component that is rejected by the 
rejection rule ; 

receiving, by the gateway, a second message specifying the first URL component, 
the second message rejected by the rejection rule; and 
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allowing, by the gateway, the second message to pass responsive to the exception 

rule. 



2. (Previously Presented) The method of claim 1, wherein the set of constraints comprises the 
number of occurrences of the first URL component exceeding a threshold, the first URL 
component having no descendents with a number of occurrences above the threshold. 

3. (Currently Amended) The method of claim 1, wherein the set of constraints requires -a-the 
frequency exceeding a threshold. 

4. (Previously Presented) The method of claim 1, further comprising applying the exception rule 
to determine whether to allow URLs comprising the first URL component and its descendants to 
pass. 

5. (Original) The method of claim 2, wherein the threshold is a product of a total number of 
URL messages over a time interval and a percentage of the messages that should be allowed. 

6. (Previously Presented) The method of claim 1 , wherein the exception rule is generated by 
inferencing a scalar data type of the descendants of the first URL component. 

7. (Previously Presented) The method of claim 1, wherein the frequency is a direct count of the 
occurrences of the first URL component. 
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8. (Previously Presented) The method of claim 1, wherein the frequency is a weighted count of 
the occurrences of the first URL component. 



9. (Currently Amended) A computer-implemented method for adaptively filtering URL 
messages routed across a network by generating exception rules to rejection rules based on 
attributes of URLs within messages previously received and rejected, the method comprising: 
receiving, by a gateway a plurality of messages, each message specifying a first 
URL component; 

rejecting, by the gateway the plurality of messages based on a rejection rule, the 
rejection rule rejecting messages based on the messages comprising-a - the first URL 
component; 

storing, by the gateway rejected URLs in a trie structure, wherein each node in the 
trie structure is associated with the-aURL component; 

maintaining, by the gateway a frequency for each node associated with a URL 
component, wherein the frequency is a function of a number of occurrences with which a 
URL component associated with a node were rejected and a number of occurrences with 
which descendants of the URL component were rejected; 

generating, by the gateway an exception rule to the rejection rule for a node 
associated with the first URL component and its descendants responsive to the frequency 
of the first URL component satisfying a set of constraints, the exception rule allowing to 
pass a message based on the message comprising the first URL component-that4s 
rejected by the rejection rule ; 
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receiving, by the gateway a the message specifying the first URL component, the 
message rejected by the rejection rule; and 

allowing the message to pass responsive to the exception rule. 

10. (Previously Presented) The method of claim 9, further comprising applying the exception 
rule to determine whether to allow URLs associated with the node and its descendants to pass. 

1 1 . (Previously Presented) The method of claim 9, wherein the set of constraints requires a 
frequency associated with the node exceeding a threshold. 

12. (Previously Presented) The method of claim 9, wherein the set of constraints requires a 
number of occurrences associated with the node exceeding a threshold, the node having no 
descendants with a number of occurrences above the threshold. 

13. (Original) The method of claim 1 1 , wherein the threshold is a product of a total number of 
URL messages over a time interval and a percentage of the messages that should be allowed to 
pass. 

14. (Previously Presented) The method of claim 9, wherein the exception rule is generated by 
inferencing a scalar data type of the descendants of the first URL component. 

15. (Original) The method of claim 9, wherein the frequency is a direct count of a number of 
occurrences of the URL component. 
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16. (Original) The method of claim 9, wherein the frequency is a weighted count of a number of 
occurrences of the URL component. 

17. (Currently Amended) A system for adaptively filtering URL messages routed across a 
network, by generating exception rules to rejection rules based on attributes of URLs within 
messages previously received and rejected, the system comprising: 

a learning engine ef- configured on a device for: 

storing rejected URLs in a trie structure, wherein each node in the trie structure is 
associated with a URL component, and wherein the rejected URLs are rejected based on 
a rejection rule, the rejection rule rejecting URLs based on the URLs comprising a first 
URL component; 

maintaining a frequency for each node associated with the-aURL component, 
wherein the frequency is a function of a number of occurrences with which a URL 
component associated with a node were rejected and a number of occurrences with which 
descendants of the URL component were rejected, and 

generating an exception rule to the rejection rule for a first node and its 
descendants, responsive to the frequency of the first U RL component associated with the 
first node satisfying a set of constraints, the exception rule allowing to pass aURLs based 
on the URL comprising the first URL component that are rejected by the rejection rule ; 
and 

a filter of -configured on t he device for applying the exception rule to a rejected URL to 
determine whether to allow the first node and its descendants. 
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18. (Canceled) 

19. (Previously Presented) The system of claim 17, wherein the set of constraints requires a 
number of occurrences associated with the first node exceeding a threshold, the first node having 
no descendants with a number of occurrences above the threshold. 

20. (Previously Presented) The system of claim 17, wherein the set of constraints requires-a the 
frequency associated with the first node exceeding a threshold. 

21. (Previously Presented) The system of claim 49-20, wherein the threshold is a product of a 
total number of URL messages over a time interval and a percentage of the messages that should 
be allowed. 

22. (Previously Presented) The system of claim 17, wherein the exception rule is generated by 
inferencing a scalar data type of the descendants of the URL component associated with the first 
node. 

23. (Previously Presented) The system of claim 17, wherein the frequency for each node is a 
direct count of the number of occurrences of the URL component associated with the 
corresponding node. 
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24. (Previously Presented) The system of claim 17, wherein the frequency for each node is a 
weighted count of the number of occurrences of the URL component associated with the 
corresponding node. 

25. (Currently Amended) A computer program product comprising: a computer-readable 
medium having computer program code embodied therein for adaptively filtering URL messages 
routed across a network by generating exception rules to rejection rules based on attributes of 
URLs within messages previously received and rejected, the computer program code adapted to: 

store rejected URLs in a trie structure, wherein each node in the trie structure is 
associated with a URL component and each node associated with a URL component 
maintains a frequency, wherein the frequency is a function of a number of occurrences 
with which a URL component associated with a node were rejected, and wherein the 
rejected URLs are rejected based on a rejection rule, the rejection rule rejecting URLs 
based on the URLs comprising a first URL component; and 

generate an exception rule to the rejection rule for a first node and its descendants 
responsive to the frequency of the -a -first URL component associated with the first node 
satisfying a set of constraints, the exception rule allowing to pass a_URLs based on the 
URL comprising the first URL component that are rejected by the rejection rule . 

26. (Previously Presented) The computer program product of claim 25, wherein each node 
associated with a URL component maintains a frequency, wherein the frequency is a function of 
a number of occurrences with which a URL component associated with a node was rejected and 
a number of occurrences with which descendants of the node were rejected. 
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27. (Previously Presented) The computer program product of claim 25, wherein the set of 
constraints requires a number of occurrences associated with the first node exceeding a threshold, 
the first node having no descendants with a number of occurrences above the threshold. 

28. (Previously Presented) The computer program product of claim 25, wherein the set of 
constraints requires the frequency associated with the first node exceeding a threshold. 

29. (Previously Presented) The computer program product of claim 25, wherein the computer 
program code is further adapted to apply the exception rule to determine whether to allow URLs 
associated with the first node and its descendants to pass. 

30. (Previously Presented) The computer program product of claim 28, wherein the threshold is a 
product of a total number of URL messages over a time interval and a percentage of the 
messages that should be allowed to pass. 

31. (Previously Presented) The computer program product of claim 25, wherein the exception 
rule is generated by inferencing a scalar data type of the descendants of the URL component 
associated with the first node. 

32. (Currently Amended) A computer-implemented method for adaptively filtering URL 
messages routed across a network, by generating exception rules to rejection rules based on 
attributes of URLs within messages previously received and rejected, the method comprising: 
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storing rejected URLs in a trie structure, wherein the rejected URLs are rejected based on 
a rejection rule, the rejection rule rejecting URLs based on the URLs comprising a first URL 
component, and wherein each node in the trie structure is associated with a URL component; and 
each node associated with a URL component maintains a frequency, wherein the frequency is a 
function of a number of occurrences with which a URL component associated with a node was 
rejected; and 

and generating an exception rule to the rejection rule for a first node and its descendants, 
responsive to the frequency of the first URL component associated with the first node satisfying 
a set of constraints, the exception rule allowing to pass a_URLs- based on the URL comprising the 
first URL component that are rejected by the rejection rule . 

33. (Previously Presented) The method of claim 32, further comprising maintaining a frequency 
for each node associated with a URL component, wherein the frequency is a function of a 
number of occurrences with which a URL component associated with a node was rejected and a 
number of occurrences with which descendants of the selected node were rejected. 

34. (Previously Presented) The method of claim 32, further comprising applying the exception 
rule to determine whether to allow the URLs associated with the first node and its descendants to 
pass. 

35. (Previously Presented) The method of claim 32, wherein the set of constraints requires the 
frequency associated with the first node exceeding a threshold. 
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36. (Previously Presented) The method of claim 32, wherein the set of constraints requires a 
number of occurrences associated with the first node exceeding a threshold, the first node having 
no descendants with a number of occurrences above the threshold. 

37. (Original) The method of claim 35, wherein the threshold is a product of a total number of 
URL messages over a time interval and a percentage of the messages that should be allowed. 

38. (Previously Presented) The method of claim 32, wherein the exception rule is generated by 
inferencing a scalar data type of the descendants of the URL component associated with the first 
node. 

39. (Original) The method of claim 33, wherein the frequency is a direct count of the number of 
occurrences of the URL component associated with the selected node. 

40. (Original) The method of claim 33, wherein the frequency is a weighted count of the number 
of occurrences of the URL component associated with the selected node. 

41. (New) The method of claim 1, further comprising rejecting the messages based on inclusion 
of the first URL component in the messages, the first URL component a hierarchical component 
of a directory path portion of an URL. 
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